Extracted

• • Target

    3afbbb402849c9eb3041a660990e20007d8a3b2fd244b0425c2d7e2eff6acc94.exe

  • Size

    721KB

  • MD5

    70602e7ff206b4f93ab42a72bc1aa588

  • SHA1

    6b0e85d90004295114a81b0066406c1ef0ed786a

  • SHA256

    3afbbb402849c9eb3041a660990e20007d8a3b2fd244b0425c2d7e2eff6acc94

  • SHA512

    dccebd67bad12301b8ab183bd0b5f0cdffa3be4296d7a06f0f2bd5c6ecb9b9199ab6019d862d5b2f8fa4c90a14d8212957a9c6e4e2513a5d257dd190ccc159d1

  • SSDEEP

    12288:l/zMjvOn6nzxiAkoqMPEMg8gmugJRmCtDEYCSDPe2O3dAmV0cz:RIj2n6nwALLglmuk8C6YCSDW2gdAmWc

  Score

  10^/10

  vipkeyloggercollectiondiscoveryevasionkeyloggerspywarestealertrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2